Privacy policy

Last updated: 9 October 2026. This is a convenience translation; the German version is authoritative.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Daniel Boberg
Klinkerwerkstraße 8
32549 Bad Oeynhausen
Germany
Email: post@folnaro.app

No data protection officer has been appointed because the legal requirements for one are not met.

2. The Folnaro app

2.1 Your data lives on your Mac

Everything you enter in Folnaro, such as customers, invoices, receipts, time entries and bank statements, is stored in a database on your Mac, inside the app's protected container. We have no access to it, and the app does not transfer this data to us unless you attach it to feedback yourself (section 2.5). With iCloud sync, a copy is also kept in your own iCloud account (section 2.6). We are not the controller of this local processing within the meaning of the GDPR. Where you process personal data of your customers in the app, you are responsible for it.

Text recognition for receipts and the suggestions for recognized fields run on your Mac using macOS features. No data is sent to us or to third parties for this.

Folnaro contains no analytics or tracking tools, no advertising and no user account.

2.2 Purchases, subscription and trial

Folnaro is distributed through the Mac App Store. Apple handles the purchase, the subscription and the payment (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Republic of Ireland). Apple processes data as an independent controller; see Apple's privacy policy.

The app checks on your Mac, through Apple's StoreKit interface, whether you may use Folnaro. This includes the date of your first download, from which the 30-day trial is derived. This check happens between the app and Apple. From Apple we receive only aggregated sales and subscription reports without names or contact details.

2.3 Crash reports through Apple

If you agreed in macOS System Settings to share analytics with app developers, Apple provides us with crash reports and usage statistics in aggregated form. They contain no content from Folnaro and do not let us identify you. You can withdraw this consent at any time under System Settings, Privacy & Security, Analytics & Improvements.

2.4 Connections you start yourself

Some features connect to third-party services at your request. We are not involved and receive no data. The privacy terms of the respective provider apply.

• VAT ID check: When you check a customer's VAT ID, Folnaro sends this number to the European Commission's VAT Information Exchange System (VIES).
• Sending email: When you send documents, Folnaro hands them to the Mail app or to the SMTP server you set up in the settings.
• Paperless-ngx: When you connect your own Paperless-ngx server, Folnaro exchanges documents with that server.
• Agents through MCP: When you connect an agent, it starts the bundled helper locally on your Mac and reads or writes within the permissions you granted. Whether and which data the agent transfers to its provider depends on the agent and provider you choose.
• Backups: Folnaro stores backups in the location you choose. If that location is a cloud storage service, its terms apply.

2.5 Feedback from the app

Help > Send Feedback lets you send us a message from the app. Nothing is sent until you click Send. Without an internet connection the message waits on your Mac and is sent automatically once you are back online, for at most seven days. If the receiving service finally refuses it, it is dropped. We transmit:

• your message, the kind of feedback and the app version,
• your email address, if you give one for our reply,
• a picture of the Folnaro window, if you turn it on (it is off at first),
• files you attach, paste or drop, such as screenshots, photos, PDFs, text or JSON files,
• if you include technical details (shown beforehand, can be turned off): app version and build, distribution channel, language and date of first launch, macOS version, Mac model, processor architecture, memory, number of displays, system language and region, time zone, appearance and accessibility settings, the state of your subscription or trial, the area you had open, the database version, the number of your records without their content, enabled features, the app's most recent error messages without personal data, and a random identifier of this installation.

The technical details contain no customer names, invoice contents, amounts, bank details or identifiers of your hardware. A window picture and attachments, however, show everything visible in them, including your customers' data. Check them in the preview before sending.

The message is sent over an encrypted connection (HTTPS) to a receiving service that we run ourselves under the domain steadycost.de. Our app Steadycost uses the same service. It runs at Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) on Cloudflare Workers. Cloudflare necessarily also processes your IP address. The receiving service delivers the message through Cloudflare Email Routing as an email from the sender no-reply@steadycost.de to our mailbox at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Cloudflare and Hetzner process the data on our behalf under Art. 28 GDPR. The transfer to the USA is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework of 10 July 2023 and, in addition, on the standard contractual clauses in Cloudflare's data processing agreement.

The receiving service does not store your message and does not log its content. It only remembers an irreversible hash of the message's random identifier for 14 days so that it does not arrive twice. To prevent abuse it counts requests per IP address (for IPv6 only the network, its first 64 bits) until one hour after your last message. It also counts requests per installation, storing only an irreversible hash of its random identifier until one day after your last message.

We use this information only to answer your request and to fix problems in Folnaro. The legal basis is Art. 6 (1) (b) GDPR where your purchase or use of Folnaro is concerned, otherwise our legitimate interest in handling your feedback and improving the app under Art. 6 (1) (f) GDPR. We delete the email as soon as your request has been handled, unless statutory retention duties apply. You can object to this processing and request erasure (section 5). Instead of using the app you can also write to us directly by email (section 4).

2.6 Sync through iCloud

If you turn on “Sync with iCloud” in Settings > iCloud, Folnaro also stores your data in the private CloudKit database of your own iCloud account, so it is the same on all your Macs with that account. This never happens unless you turn it on.

• The provider is Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Republic of Ireland). The data lives in your iCloud account under your agreement with Apple, see Apple’s privacy policy.
• We have no access to this data. The private database belongs to your account, and the content of your records is stored end-to-end encrypted with keys from your iCloud Keychain. Files such as receipts and archived PDFs are protected like your other iCloud data, end-to-end encrypted if you have turned on Advanced Data Protection for iCloud.
• Only technical details are not encrypted: a version number of the data format and a random identifier of your Mac.
• Turning sync off keeps all data on your Mac. “Remove from iCloud” deletes the copy in iCloud; the data on your Macs stays.

The legal basis is Art. 6(1)(b) GDPR: sync is a feature of Folnaro that you turn on yourself.

3. This website

3.1 Hosting

The website consists of static files only and is delivered through the network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. We run no server of our own for it. When a page is requested, Cloudflare processes technically necessary data: IP address, date and time, requested address, referrer, browser and operating system. This is needed to deliver the pages and to protect the website against attacks and abuse. The legal basis is our legitimate interest in a secure and available website under Art. 6 (1) (f) GDPR.

We do not store any server logs ourselves. Cloudflare's logging, log export and visitor analytics are switched off for this website. How long Cloudflare keeps data to operate and secure its network is governed by Cloudflare's privacy policy. A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Data may be transferred to the USA in the process. This is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which Cloudflare is certified, and in addition on the standard contractual clauses in the data processing agreement.

3.2 No cookies, no tracking, no external content

This website sets no cookies, stores nothing in your browser and uses no analytics tools. Images and styles are served by this website itself; fonts come from your device. No content is loaded from third parties. Links to the App Store or other websites connect you to that provider only when you click them.

4. Contact by email

When you write to us, we process your email address, your name and the content of your message to answer your request. The legal basis is Art. 6 (1) (b) GDPR where your request concerns a purchase or the use of Folnaro, otherwise our legitimate interest in answering under Art. 6 (1) (f) GDPR. We delete messages once the request is settled and no statutory retention duties apply.

Email to addresses at folnaro.app is received by Cloudflare Email Routing (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) and forwarded without being stored to our mailbox at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Cloudflare and Hetzner process the data on our behalf under Art. 28 GDPR. The transfer to the USA relies on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework of 10 July 2023 and, in addition, on the standard contractual clauses in Cloudflare's data processing agreement.

5. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7 (3)). Write to the address above.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority competent for us: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2⁠–⁠4, 40213 Düsseldorf.

6. No automated decision-making

We make no automated decisions within the meaning of Art. 22 GDPR and create no profiles.

7. Changes

We update this policy when the app, the website or the law changes. The version published here applies.